I read the AI security research published in a single month, February 2026, and when you put it all together, it’s not a list of curiosities. It’s a field guide to a new attack surface. In my previous piece, I explained how MITRE ATLAS catalogs threats to AI. Here, I take the next step: I map that research onto ATLAS. What emerges is a complete kill chain, and the target is no longer the model. It’s the agent.
When you look at AI security research published in a single month, one thing stands out: much of the work has stopped focusing on model behavior in isolation and has started examining real attack paths through agents, skills, protocols, and connected environments. The question is no longer “how do I make the chatbot say something forbidden?” but “how do I compromise an agent that can take action?”
This is the shift I anticipated when discussing the expansion of the agentic side of ATLAS, and research is now filling it with real substance. An agent isn’t just a model with a chat interface. It has persistent memory, a supply chain of skills and tools, protocols for connecting to external services, and hands that can perform actions on your systems. Each of these is an attack surface. If you map February’s research onto the MITRE ATLAS matrix, you don’t get a collection of isolated cases. You get a complete attack lifecycle. Let’s walk through it.
(ATLAS — Reconnaissance, AML.T0014 AI Model Reconnaissance)
The first stage of any attack is understanding your target. Research now shows that reconnaissance itself has become an AI task. A study involving, among others, Nicholas Carlini and Florian Tramèr demonstrates large-scale deanonymization using an LLM agent: a pipeline that extracts identity-related signals from text, retrieves potential matches and verifies them, challenging the idea of “practical anonymity” — the assumption that among billions of people, you are effectively anonymous.
This takes reconnaissance to an industrial scale, and it targets people, not just systems. It brings back a point I’ve made for some time: identity is the battlefield, and attackers now have a tool that can connect public fragments into a profile at a speed and scale no human analyst could match.
(ATLAS — AML.T0110 AI Agent Tool Poisoning, AML.T0011.002 Publish Poisoned AI Agent Tool)
This is the most crowded area in February’s research, and the one I consider most important because it opens an attack surface that didn’t exist a year ago: the agent supply chain.
A large-scale empirical study analyzed almost 98,380 skills distributed across two marketplaces. Using static analysis, sandbox execution, and manual review, the funnel narrowed down to 157 confirmed malicious skills, organized into two main types: data stealers and agent hijackers. These attacks used multi-stage chains and increasingly sophisticated hiding techniques, including hiding malicious behavior in the skill’s own documentation. For the agent world, this is the equivalent of the first major cases of malicious packages in software repositories: a dependency you install and trust that works against you.
Two other studies confirm the offensive potential. One benchmark shows that widely used agents perform harmful actions when a compromised skill is installed, while another framework demonstrates that stealthy skill-based injection can be automated through a feedback loop that improves its effectiveness. A fourth study targets the infrastructure itself, the Model Context Protocol, which agents use to connect to external tools and data, and proposes a secure architecture because the current one simply isn’t secure enough.
The message is the same one I repeat when discussing compromised supply chains: the tool you trust becomes the weapon. The difference is that here the tool isn’t a compromised WordPress site. It’s a skill you give to an agent with access to your files, email, and systems.
(ATLAS — AML.T0051 LLM Prompt Injection, sub-techniques .000 direct and .001 indirect)
Prompt injection remains a high-volume technique, but February’s research shows that it has stopped being a manual craft. One study uses reinforcement learning to automatically discover injection strings that reliably manipulate an agent’s behavior, while preserving the appearance of a legitimate task and transferring to other agents and tasks. Another, an adaptive red-teaming framework for web agents, identifies injection surfaces from execution traces and automatically discovers multi-step attacks. A systematic review builds a complete taxonomy of these techniques.
This isn’t theory, and that’s the point I want to emphasize. These are already CVEs. EchoLeak (CVE-2025-32711) enabled zero-click data exfiltration from a Copilot assistant through prompt injection. CurXecute (CVE-2025-54135/54136) enabled remote code execution through an IDE’s MCP implementation. The gap between an “arXiv paper” and a vulnerability with a CVE number is now measured in weeks.
(ATLAS — AML.T0054 LLM Jailbreak)
One line of research continues to focus on the model itself and shows something uncomfortable: some defenses are structural, and can therefore be bypassed structurally. One study presents an automated jailbreak that uses feedback from security filters to refine prompts, without internal access to the model. Another exposes a systematic vulnerability in open-weight models to prefill attacks, which manipulate the prefilled context state to bypass protections, going beyond classic text-based jailbreaks. A third study shows that, in mixture-of-experts models, security behavior is concentrated in a small number of “experts.” Silencing them can cause a broad failure of the model’s protections.
I won’t go into the operational details, for obvious reasons. The systemic point is that when security is concentrated in one component, whether a filter, a state, or a group of experts, that component becomes the target. On the defensive side, another study proposes detecting hidden jailbreaks by separating the goal from the linguistic framing used to disguise it within the model’s internal representations. It’s the same idea of “ambiguous techniques” I’ve written about, now applied inside the model.
(ATLAS — Impact tactic; AML.T0086 Exfiltration via AI Agent Tool Invocation; cross-agent propagation)
This is the stage that separates “the model said something wrong” from “the agent did something wrong to your systems.” A red-teaming study placed autonomous agents in a real environment, with persistent memory, email, Discord access, a filesystem, and shell command execution. In eleven documented cases, researchers observed the full range: obeying someone who wasn’t the owner, disclosing sensitive information, destructive actions on the system, denial-of-service conditions, uncontrolled resource consumption, identity spoofing, propagation of unsafe practices from one agent to another, and partial system takeover.
This is the part that keeps me awake. Cross-agent propagation, in particular, is a new phenomenon: malicious behavior spreading between agents like a worm through shared memory and conversations. When the actors are no longer just humans but agents talking to each other, the attack surface is no longer the sum of the individual systems. It’s the network.
If you overlay a single month of research onto the ATLAS matrix, the agentic angle lights up across the entire kill chain: AI-assisted reconnaissance, poisoned skill and tool supply chains, industrialized prompt injection, structural jailbreaks, impact on systems, and propagation between agents. These aren’t isolated anecdotes. They form a coherent lifecycle. That’s exactly why, between October 2025 and February 2026, ATLAS added agentic techniques, from skill poisoning to exfiltration through tool invocation. Research and the framework are evolving together in real time.
The practical advantage of this map is that it gives AI incidents the same language that your SOC already uses for traditional threats. ATLAS identifiers are designed to work like those in ATT&CK, such as AML.T0051 alongside T1557, and to fit into the same runbooks and detection rules. It’s the common language I’ve been talking about.
Three steps, none particularly exciting, but all critical.
The first is inventory. You can’t protect agents, skills, or MCP servers you don’t know you have. Most techniques in this kill chain assume that someone on the other side understands your attack surface better than you do. The first control is therefore a census, the same lesson that appears in every security program, simply applied to a new layer.
The second is to treat skills and tools as a supply chain: verify them, run them in sandboxes, pin their versions, and monitor them. This is the discipline we learned, too late, for software dependencies. The study of 157 malicious skills is the moment when the agent world discovers that it has the same problem. We shouldn’t let it take fifteen years to catch up.
The third is to watch what the agent does, not just what it says. The highest-impact techniques, including tool invocation, exfiltration, and context poisoning, don’t necessarily appear as a single suspicious message. They show up as behavioral drift and anomalies in tool calls. Much of this activity is invisible to network and endpoint tools because it can look like normal HTTPS traffic inside authorized applications, the threat that looks like legitimate work that I’ve been writing about for months.
What’s needed is runtime telemetry covering prompts, context state, and tool calls, with a baseline for each individual agent. This is the level of detection that almost nobody has today.
A single month of research reads like a complete attack cycle against agents, and it maps cleanly onto a framework that didn’t even include these techniques a year ago. The frontier has shifted clearly: the model was never the whole story. An agent is a supply chain, a memory, and a pair of hands, and each of these is now a documented attack surface with an identifier next to it.
It was never just a technology problem. Once again, it comes down to discipline: inventory what we are deploying faster than we can secure it, treat agent tools as a supply chain, and monitor actions rather than words. The map exists. The challenge is to use it while the territory is still moving, because this time, unlike fifteen years ago with networks, the territory is moving faster than the map.
About the author: Simone Fratus
Chief Technology Officer, Orizon
Territory Account Manager, Syneto – Enterprise and Large Public Administration
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, AI agents)